What licence open data carries, and what you may do with it

A dataset you can download without asking is not necessarily a dataset you can republish. The download is a technical fact; what you may do next is a licence, and the licence is a field in the metadata that almost nobody reads. This guide is about that field: where it is, what the usual values mean in practice, and the handful of cases where “open data” is a label on something that is not open.

Find the licence first, not last

Every platform records it in a different place, and all of them record it:

• CKAN — license_id and license_title on the dataset, returned by package_show. Our guide on how to query a portal’s API covers the request.
• DCAT / data.json — a license on each distribution, not on the dataset, so two files in the same dataset can differ.
• OpenDataSoft and Socrata — in the dataset’s metadata block, usually beside the publisher.
• No field at all — look for the portal’s legal notice or terms of reuse, which is where most public administrations put a single licence covering everything they publish.

An empty licence field is not permission. It is an unanswered question, and the answer is usually in that legal notice.

The licences you will actually meet

CC0 / public domain dedication. Do what you like, including commercially, with no attribution obligation. Attribute anyway: it costs one line and it is how a reader checks your figure.

CC BY 4.0 — and its national equivalents. Copy, adapt, sell; name the source. Attribution means the publisher, the dataset title, the licence and, where practical, a link. “Source: INE” satisfies almost every regulator; a figure with no source satisfies nobody.

ODbL (Open Database License, the one OpenStreetMap uses) adds share-alike: a derived database has to be published under the same terms. It does not force you to open-source your software, and a map image you produce from it is a “produced work” with lighter duties than a database you redistribute. If your product is the data, read it closely.

Government-specific open licences — the UK’s Open Government Licence, France’s Licence Ouverte, Spain’s standard reuse conditions — are almost all attribution-only and deliberately compatible with CC BY. Treat them as CC BY and you will rarely be wrong.

US federal works. Works of the federal government are outside copyright in the United States (17 U.S.C. § 105). That is not a licence, it is the absence of one, and it does not extend to contractor material, state and city governments, or third-party content bundled inside a federal release.

The European database right, which surprises people

In the EU, a database can be protected even when nothing inside it is: the sui generis right in Directive 96/9/EC rewards substantial investment in obtaining, verifying or presenting the contents, and it bites on extraction of a substantial part. So a table of facts — none of them copyrightable — can still be a protected database, and a public-domain claim about the contents says nothing about the collection.

For public sector information the picture is friendlier: the Open Data Directive (EU) 2019/1024 makes reuse the default, requires open, machine-readable formats, and bars public bodies from asserting the database right to block reuse of documents they hold. In Spain that arrives through Ley 37/2007 and RD 1495/2011, whose default is reuse without prior authorisation and with attribution — which is why so many Spanish portals carry no per-dataset licence at all, only an aviso legal.

Two carve-outs remain in most member states: high-value datasets that must be free of charge, and everything else, where a body may still charge marginal costs.

When “open” is not open

Three terms turn an open-data page into a closed one:

• Non-commercial only. Common, and it makes the dataset unusable for any product, including an ad-supported site. It is also incompatible with CC BY, so you cannot mix it into a CC BY release.
• No derivatives, or a ban on “modifying” the data. Analysis is derivation.
• Registration or an API key tied to accepted terms that differ from the published licence. The terms you clicked are the ones that bind you.

A portal that publishes datasets under these and calls the result open data is doing what the field calls open washing: the format is open, the rights are not.

Personal data is a separate question

A licence answers copyright and database rights. It does not answer data protection. A published dataset can still contain personal data — a public register of licence holders, a procurement file with names — and in the EU the GDPR applies to your reuse of it regardless of the licence, including the re-identification risk you create by joining two “anonymous” sets. An open licence is never a lawful basis.

A working habit

Write the licence and the retrieval date into the same file as the data, in a one-line header or a sidecar note: publisher, dataset, licence, URL, date. It takes five seconds at download and it is unrecoverable three months later, when the portal has re-published the file and you have to decide whether you may still use what you have.

Asking for records that are not published yet is a different problem — our guide on how to file a FOIA request covers it. The Spanish version of this guide is at Qué licencia tienen los datos abiertos.